diff --git a/0080-Fix-timing-side-channel.patch b/0080-Fix-timing-side-channel.patch new file mode 100644 index 0000000000000000000000000000000000000000..83b14e40d8d0c5a89913ef3993b5d3393ad13f71 --- /dev/null +++ b/0080-Fix-timing-side-channel.patch @@ -0,0 +1,113 @@ +From 1614a65a25ed2265d57147a9a79e6ec0269bf328 Mon Sep 17 00:00:00 2001 +From: root +Date: Sun, 23 Feb 2025 15:39:46 +0800 +Subject: [PATCH] Fix timing side-channel in ECDSA signature computation +There is a timing signal of around 300 nanoseconds when the top word of +the inverted ECDSA nonce value is zero. This can happen with significant +probability only for some of the supported elliptic curves. In particular +the NIST P-521 curve is affected. To be able to measure this leak, the +attacker process must either be located in the same physical computer or +must have a very fast network connection with low latency. + +Attacks on ECDSA nonce are also known as Minerva attack. + +Fixes CVE-2024-13176 + +Reviewed-by: Tim Hudson +Reviewed-by: Neil Horman +Reviewed-by: Paul Dale + +--- + .../OpensslLib/openssl/crypto/bn/bn_exp.c | 21 +++++++++++++------ + .../OpensslLib/openssl/crypto/ec/ec_lib.c | 6 +++--- + .../OpensslLib/openssl/include/crypto/bn.h | 3 +++ + 3 files changed, 21 insertions(+), 9 deletions(-) + +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c +index 4e169ae1..a161e580 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c +@@ -598,7 +598,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, + * out by Colin Percival, + * http://www.daemonology.net/hyperthreading-considered-harmful/) + */ +-int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, + BN_MONT_CTX *in_mont) + { +@@ -615,10 +615,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + unsigned int t4 = 0; + #endif + +- bn_check_top(a); +- bn_check_top(p); +- bn_check_top(m); +- + if (!BN_is_odd(m)) { + ERR_raise(ERR_LIB_BN, BN_R_CALLED_WITH_EVEN_MODULUS); + return 0; +@@ -1138,7 +1134,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + goto err; + } else + #endif +- if (!BN_from_montgomery(rr, &tmp, mont, ctx)) ++ if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx)) + goto err; + ret = 1; + err: +@@ -1152,6 +1148,19 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, + return ret; + } + ++int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++ const BIGNUM *m, BN_CTX *ctx, ++ BN_MONT_CTX *in_mont) ++{ ++ bn_check_top(a); ++ bn_check_top(p); ++ bn_check_top(m); ++ if (!bn_mod_exp_mont_fixed_top(rr, a, p, m, ctx, in_mont)) ++ return 0; ++ bn_correct_top(rr); ++ return 1; ++} ++ + int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p, + const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont) + { +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c +index b1696d93..7f247d9e 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c +@@ -1262,10 +1262,10 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r, + if (!BN_sub(e, group->order, e)) + goto err; + /*- +- * Exponent e is public. +- * No need for scatter-gather or BN_FLG_CONSTTIME. ++ * Although the exponent is public we want the result to be ++ * fixed top. + */ +- if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data)) ++ if (!bn_mod_exp_mont_fixed_top(r, x, e, group->order, ctx, group->mont_data)) + goto err; + + ret = 1; +diff --git a/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h b/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h +index fd1c09d9..ba50bca2 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h ++++ b/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h +@@ -73,6 +73,9 @@ int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words); + */ + int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, + BN_MONT_CTX *mont, BN_CTX *ctx); ++int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, ++ const BIGNUM *m, BN_CTX *ctx, ++ BN_MONT_CTX *in_mont); + int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, + BN_CTX *ctx); + int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont, +-- +2.33.0 + diff --git a/edk2.spec b/edk2.spec index 4e91f55b3e74530ce79896cb1faf7d23c801c4c7..9df8bf1d3f618a6dbf337eb83510984b763e00a3 100644 --- a/edk2.spec +++ b/edk2.spec @@ -7,7 +7,7 @@ Name: edk2 Version: %{stable_date} -Release: 16 +Release: 17 Summary: EFI Development Kit II License: BSD-2-Clause-Patent and OpenSSL and MIT URL: https://github.com/tianocore/edk2 @@ -125,6 +125,9 @@ patch77: 0077-VirtioDxe-add-support-of-MMIO-Bar-for-virtio-devices.patch patch78: 0078-Virtio-wait-virtio-device-reset-done.patch patch79: 0079-VirtioBlk-split-large-IO-according-to-segment_size_m.patch +# Fix CVE-2024-13176 +patch80: 0080-Fix-timing-side-channel.patch + BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command isl %description @@ -394,6 +397,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Sun Feb 23 2025 huyu - 202308-17 +- fix CVE-2024-13176 + * Fri Nov 29 2024 adttil<2429917001@qq.com> - 202308-16 - vdpa: support vdpa blk/scsi device boot @@ -403,12 +409,12 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys * Mon Oct 14 2024 shenyage - 202308-14 - fix CVE-2023-45236、CVE-2023-45237 -* Mon Sep 23 2024 hanliyang - 202308-13 -- Add support for running in Hygon CSV3 guest - * Wed Oct 09 2024 zhangxianting - 202308-12 - fix CVE-2024-38796 +* Mon Sep 23 2024 hanliyang - 202308-13 +- Add support for running in Hygon CSV3 guest + * Fri Sep 13 2024 Xiaotian Wu - 202308-11 - add LoongArch support - backport edk2-platform to build with edk2-2308